June 3, 2026, marks the compliance deadline for "smaller" SEC-registered investment advisers (RIAs) to meet the amended Regulation S-P, which focuses on protecting non-public personal information. Small entities—generally defined as advisors with less than $1.5 billion in assets under management (AUM)—must implement enhanced cybersecurity, data breach incident response programs, and stricter vendor oversight by this date.
Here is how "small entity" RIAs should prepare for the June 3, 2026, deadline:
1. Key New Requirements for Small RIAs
Incident Response Program: You must develop, implement, and maintain written policies and procedures to detect, respond to, and recover from unauthorized access to customer information.
30-Day Client Notification Rule: If sensitive customer information is accessed without authorization, you must notify affected individuals as soon as practicable, but no later than 30 days after discovery.
Vendor Management: You must adopt written policies requiring due diligence and monitoring of third-party service providers. Contracts must include clauses for the vendor to notify you of a breach within 72 hours.
Expanded Safeguards: The rules now apply to information received from other financial institutions, not just your own clients.
Recordkeeping: You must maintain written records of policies, incident responses, and vendor oversight for five years.
2. Action Steps to Take Before June 3, 2026
Perform a Gap Analysis: Review current cybersecurity policies against the new requirements to identify where your procedures fall short.
Update Vendor Contracts: Review and revise service provider agreements to include the 72-hour notification requirement and data protection standards.
Document Data Flows: Identify where customer information resides within your firm and with third-party vendors.
Create/Test Incident Response Plan: Develop a tailored incident response plan, including templates for client notification letters, and conduct a tabletop simulation to test it.
Update Disposal Procedures: Ensure procedures for destroying consumer information (both paper and electronic) are documented and secure.
3. Regulatory Context
The SEC has emphasized that while compliance requirements are proportional to firm size, smaller firms must still demonstrate that their policies and procedures accurately reflect their specific operational model. The SEC has initiated a "sweep" of exams, making preparedness crucial before the 2026 deadline.

Amended Regulation S-P Checklist: 4 Key Requirements and What to Prioritize Now

On May 16, 2024, the SEC expanded the requirements of Regulation S-P to require covered financial institutions to take additional steps to detect, respond, and recover from unauthorized access, or use, of client information. Larger entities, such as Registered Investment Advisers (RIAs) with $1.5 billion or more in assets under management, will have until December 3, 2025, to comply. The compliance deadline for smaller entities is June 3, 2026 (for information on which entities will be considered “larger entities,” click here).

To meet the compliance deadline, advisers should review this list and make sure you have a plan to tackle each of these requirements.

Checklist for Regulation S-P Success: 4 Key Components

Create or Enhance Your Vendor Management Program: We recommend starting here. The amendments formally establish requirements for covered institutions to adopt policies and procedures regarding due diligence and monitoring of service providers. Under Amended Regulation S-P, policies must be reasonably designed to ensure service providers take appropriate measures to
Protect against unauthorized access or use of customer information; and
Provide notification to covered institution clients within 72 hours of becoming aware of a breach resulting in unauthorized access to a customer information system maintained by the service provider. Upon receipt of notification, a covered institution must initiate its incident response program.
Already have a program in place? Chances are you’ll need to expand it, given Amended Regulation S-P’s definition of a service provider, which is very broad and refers to “any entity that receives, maintains, processes, or otherwise is permitted access to customer information through its provision of services directly to a covered institution.”  It can also include affiliates of a covered institution, so for many advisers, this program will need to be significantly more robust than it has been previously.

Additionally, the 72-hour notice requirement may be challenging, especially for smaller entities. You should begin your review process sooner rather than later and work with service providers to confirm they will provide notice within 72 hours. One way to document this confirmation is through the service provider’s agreement.

Incident Response Program: Next, make sure you update your policies and procedures to include specifics on your Incident Response Program. Under the adopted amendments, covered institutions will be required to maintain an incident response program. The program must be designed to detect, prevent, respond, and recover from unauthorized access. Note: Even if you have an incident response plan in place, you will still need to update your program to comply with the adopted amendments.
Customer Notification Requirement: Next, covered institutions will be required to notify those whose sensitive information was, or was reasonably likely to have been, accessed or used, within 30 days of an incident. For many firms, particularly smaller firms, this will be a challenge. Take time to formalize the specific steps you would need to take in the event of a breach, and document those in your policies and procedures.
Recordkeeping and Expansion of Safeguards and Disposal: Make sure you are taking the appropriate steps to maintain written records evidencing compliance with the amended rules. The rules were expanded to include any information maintained by transfer agents. The Books and Records Rule was amended in conjunction with Regulation S-P to add paragraph (25), which includes:
Records of written policies and procedures;
Written documentation of any detected unauthorized access, any response to, and recovery from such access;
Written documentation of any investigation and determination made regarding whether notification is required, including the basis for such determination, as well as any notice transmitted; and
Any written contracts or agreements entered into pursuant to the rule. For RIAs, these records must be maintained for five years, the first two in an easily accessible place.
In addition to being requirements under Amended Regulation S-P, all four of these requirements are also best practices for an RIA cybersecurity program.

New Reg S-P Requirements for RIAs

The compliance deadlines for the SEC’s amendments to Regulation S-P, adopted on May 15, 2024, are approaching. For investment advisers with $1.5 billion or more in assets under management, the compliance deadline is December 3, 2025. Advisers with fewer than $1.5 billion in AUM have six more months, with a compliance deadline of June 3, 2026.

Critically, Reg S-P now requires RIAs to notify clients in the event of certain data breaches. Under the amended rule, RIAs must notify clients of any event that could endanger their personal data, unless the RIA has determined, after reasonable investigation, that sensitive client information has not been, and is not reasonably likely to be, used for substantial harm or inconvenience. Such notice must be sent as soon as practicable, and no later than 30 days after learning of the breach, to any affected or potentially affected clients. If the RIA cannot identify which clients may be affected, the RIA must notify all of its clients. Substantively, any such notification must:

Describe the breach and the type of client information that was or is reasonably believed to have been affected by the breach;
Describe what has been done to protect client information from further breach;
Include, if known, any of the following: the breach’s date, estimated date, or date range;
Include contact information for affected clients to ask the RIA for information and help regarding the breach, including the following: a phone number, an email address, a mailing address, and the name of a specific office to contact;
Recommend that the client review account statements and immediately report any suspicious activity to the RIA;
Explain fraud alerts and how clients may place them in their credit reports to notify creditors of potential fraud;
Recommend that clients regularly check credit reports from the major reporting agencies and delete information connected to fraudulent transactions;
Explain how clients can get free credit reports; and
Include information about the Federal Trade Commission (FTC) and online guidance from usa.gov about how clients can protect against identity theft, a statement encouraging clients to report any incidents of identity theft to the FTC, and include the FTC’s website address where clients can get government information about identity theft and report suspected identity theft.
At a September 25th, 2025 compliance outreach session, the SEC highlighted the Commission’s remaining points of emphasis in an examination. First, the SEC will be concerned with network security. Next, the SEC will be interested in reviewing the channels the RIA uses to transfer data. Specifically, the Commission will be looking at security when the RIA transfers data into and out of its network.

Examiners recommend using a risk matrix and also recommend they “go a little bit deeper” with their risk assessment than simple low, medium, or high designations. Lastly, SEC examiners stressed the need for heightened requirements monitoring third-party service providers. Examiners also emphasized ensuring that third-party service providers can detect and notify the RIA of a breach within 72 hours.

Finally, the SEC reiterated the importance of documenting each procedure, process, and precaution implemented by the adviser, as well as all decisions and actions taken in the notification process.

Any SEC-registered RIA should consult experienced legal counsel to ensure compliance with the amended Reg S-P before their compliance deadline.

New Regulation S-P Amendments: Are You Prepared?
Regulation S-P, under the Gramm-Leach-Bliley Act (GLBA), requires broker-dealers, investment companies, and investment advisers to protect consumer financial information and inform customers about their privacy practices. Recent amendments modernize Regulation S-P to tackle evolving cybersecurity threats and technological changes since 2000.

Contract and vendor reviews may take months—if you want to meet compliance deadlines, start preparing now.

Three Key Changes You Need to Address Immediately:
1. Vendor Notification Within 72 Hours
Vendors must notify you within 72 hours if unauthorized access is detected on systems holding your client data. While major custodians likely already comply, smaller vendors might require significant lead time to renegotiate contracts or implement necessary procedures. Delaying could force difficult decisions about critical vendor replacements.

Begin vendor assessments and contract reviews now, particularly for:

MSPs
CPAs
CRMs not specialized in financial services
Download the Guide
Click here!

2. Incident Response Triggers
Your Incident Response Plan (IRP) now triggers immediately upon any unauthorized data access incident—even minor or accidental ones. Updating and testing your IRP will take considerable effort and cross-functional coordination, so don't wait until the compliance deadline approaches.

Common new triggers include:

Employees unintentionally accessing sensitive data
Vendor notifications of unauthorized access, even without a confirmed breach
3. Comprehensive Logging Requirements
Under the amended Regulation S-P, you're required to notify individuals whose data may have been accessed unless detailed logs prove otherwise. Without comprehensive logging, you'll need to assume all data was compromised, vastly increasing notification obligations.

Implementing robust logging takes significant time and resources, so begin this work immediately to:

Accurately determine affected individuals
Minimize unnecessary notifications
Efficiently demonstrate compliance to regulators
Action Steps to Start Today:
Vendor Inventory: Identify and assess all vendors handling sensitive client data.
Review Contracts: Ensure vendor agreements clearly state the 72-hour notification requirement.
Implement Logging: Develop comprehensive logging to track unauthorized access effectively.
Update and Test IRP: Define incidents clearly, assign team roles, document procedures, and regularly test response effectiveness.
Compliance Deadlines
RIA Category	AUM Threshold	Compliance Deadline
Larger RIAs	≥ $1.5 billion (AUM)	December 3, 2025
Smaller RIAs	< $1.5 billion (AUM)	June 3, 2026
These amendments significantly impact your firm's data protection, vendor management, and incident response processes. Acting now ensures smoother compliance and fewer disruptions later.

CyberSecureRIA can help your firm navigate these changes proactively, including:

Risk Assessments
Policies and Procedures Development
Vendor Due Diligence
Vulnerability Assessments
Cybersecurity Training

The 2026 Registered Investment Adviser (RIA) compliance calendar requires key SEC and state filings, including the Annual Updating Amendment to Form ADV (due March 31, 2026), Form 13F (quarterly, next due Feb 17, 2026), and Form 13H for large traders (annual due Feb 17, 2026, or quarterly). Key milestones include Form PF (March 1/April 30), client delivery of Form ADV 2A (April 30), and annual compliance reviews.
Key 2026 RIA Compliance Deadlines
February 17, 2026:
Annual Filing of Form 13H (Large Traders) with the SEC.
Form 13F Quarterly Filing for Q4 2025.
Form 13G Filing for Qualified/Exempt Investors.
Form SHO short position reporting (if threshold crossed in Jan 2026).
March 1, 2026:
Form PF Quarterly Update (Large Hedge Fund Advisers).
Annual affirmation of NFA/CFTC exemptions.
March 31, 2026:
Annual Amendment to Form ADV (Part 1 and 2A) for SEC and state-registered advisors.
State-specific notice filings.
Annual compliance policy review (Rule 206(4)-7).
April 10, 2026: Form 13H Quarterly Filing for changes.
April 30, 2026:
Delivery of audited financial statements for pooled investment vehicles to investors.
Delivery of Form ADV 2A to clients.
Form PF Annual Update (Private Fund Advisers).
Quarterly Transaction Reports.
May 15, 2026: Form 13F Filing for Q1 2026.
May 30, 2026: Form PF for Q1 2026.
June 3, 2026: Compliance Date for Regulation S-P Amendments (entities < $1.5B AUM).
Important Notes
Weekends/Holidays: When deadlines fall on weekends or holidays, they are generally adjusted to the next business day (e.g., Feb 16 is President's Day, pushing Feb 13H deadlines to Feb 17).
Form 13H/13F: 13H must be updated promptly after a quarter-end if information becomes inaccurate. 13F is due within 45 days of quarter-end.
Regulation S-P: Amendments regarding unauthorized access to customer information must be implemented by June 3, 2026, for smaller firms.

2026 Annual and Periodic Reporting & Compliance for Investment Managers